magento / magento/magento-coding-standard
Escaping for XML is caught by DiscouragedFunctionSniff
- Dominant language
- PHP
- Stars
- 375
- Forks
- 165
- PR merge metrics
- No merged PRs in 30d
Description
### Description
The following code ` htmlspecialchars($string, ENT_XML1, "UTF-8")` triggers the warning
```
38 | WARNING | The use of function htmlspecialchars() is discouraged; use
| | \Magento\Framework\Escaper->escapeHtml() instead
| | (Magento2.Functions.DiscouragedFunction.DiscouragedWithAlternative)
```
### Expected behavior
The suggested alternative is not an equivalent solution. A brief search over the Magento codebase also reveals there is no mention of `ENT_XML1`. Also `\Magento\Framework\Escaper::$htmlSpecialCharsFlag` is a private property making it impossible to set `ENT_XML1` in a custom implementation.
### Benefits
Ensure XML content can be generated correctly with-in a Magento module.
### Additional information
Solutions would be either to a.) ensure the discouraged function sniff only triggers in code that is covered by the alternative or b.) add options to escape for XML in `\Magento\Framework\Escaper`
Contributor guide
Research direction
Start by reading the DiscouragedFunctionSniff behavior for htmlspecialchars() and the Magento\\Framework\\Escaper handling of $htmlSpecialCharsFlag. Compare the ENT_XML1 use case with the suggested escapeHtml() alternative and determine the intended scope of the sniff. Done means valid XML escaping is supported without an incorrect warning, with coverage for the chosen behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- tooling
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100